SSH2FA 1.7.0 — login-node tunnels, location gate, web interface

Tunnels can now point at a cluster's login node and move between login
nodes. Connections can be limited to places you trust, and there's a
web interface and a single command to run everything on Linux.

Tunnels to the login node

A service running on the login node itself — no SLURM job — can now be
tunnelled to. Open a tunnel's Node picker and choose Use login node.
An existing compute-node tunnel can switch to the login node and back; the
last compute node is remembered.

A tunnel already on one login node can move to another: pick the host in the
picker's new Cluster menu (TUI: h), then Use login node. A host
that isn't connected yet can still be chosen; the tunnel starts once it is.

CLI: ssh2fa login-node <tunnel> <host>.

Location gate

Settings → Location: only connect automatically from allowed countries,
regions, cities, network operators or IP ranges. Automatic connections from
anywhere else are paused. Connections that are already live stay up, and a
manual Connect anyway always works. Nothing is looked up while the gate
is off. CLI: ssh2fa location.

Web interface

ssh2fa web on serves hosts, credentials, tunnels (with the SLURM node
picker), location and logs over HTTPS with live updates. It runs as a
separate process that only allows an explicit list of actions, uses a
self-signed certificate whose fingerprint is printed, and is protected by a
256-bit token plus CSRF checks and per-address lockout.

One command on Linux

ssh2fa up | restart | down | doctor uses systemd when it's reachable and
starts the daemon directly when it isn't. restart always keeps SSH
connections alive. doctor points out common setup problems.

Fixes

• Direct tunnels respawned every minute. The forwarding process exited
  right after starting, and the respawn then failed with "port forwarding
  failed", looping forever. They now stay up, and stopping one actually
  frees its port.
• Starting the daemon with an empty host list no longer kills every live
  SSH connection.
• On Linux, a file vault is used when no keyring answers, instead of every
  host failing.